us3-skill

Upload files to UCloud US3 object storage and generate public URLs

This skill's code matches its purpose (upload local files to UCloud US3) but contains several red flags you should consider before installing: - Runtime/dependency gaps: Examples call `node` and the code requires npm packages (ufile, mime) but the skill declares no required binaries and has no install step. Ensure Node and the listed npm deps are installed in the agent environment before use. - Unused/extra env var: SKILL.md and metadata request US3_ENDPOINT but the script does not use it — verify whether your environment needs that variable or if the skill is out of sync with its docs. - Sensitive credentials: The skill needs your US3_PRIVATE_KEY and US3_PUBLIC_KEY. These grant upload access to the bucket; only provide keys you trust, consider using least-privilege credentials, and rotate/revoke keys if you stop using the skill. - Exfiltration risk: The tool will read arbitrary local files you point it at and upload them to a public bucket. Don't run it with paths to secrets or sensitive files unless you intend those files to become publicly accessible. - Operational suggestions: Confirm the bucket domain format is correct for your region, run the script in a sandbox or test account first, install dependencies from trusted sources (npm registry), and consider updating the skill to declare Node as a required binary or to include a safe install step. If you want to proceed, verify/prepare the runtime (Node + npm deps), supply credentials scoped appropriately, and test uploads with non-sensitive files first.

Type: OpenClaw Skill Name: us3 Version: 1.0.0 The OpenClaw AgentSkills skill bundle for UCloud US3 storage appears benign. The `SKILL.md` clearly outlines its purpose to upload files and generate public URLs, requiring UCloud API keys via environment variables, which is standard practice. The `upload.mjs` script correctly parses command-line arguments using `node:util.parseArgs`, preventing direct shell injection into the Node.js script. While the `--key` parameter example in `SKILL.md` shows shell command substitution (`$(date ...)`) for dynamic naming, this is executed by the invoking shell (the AI agent) before the argument reaches the Node.js script, which then treats the result as a literal string for the object key. The script uses standard Node.js modules and the legitimate `ufile` SDK for UCloud interaction. There is no evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, obfuscation, or other malicious behaviors. The ability to read local files is inherent to an upload skill, and there's no indication of intent to access sensitive files beyond what's explicitly provided as input.